CVE-2020-28971

CRITICAL

9.8

CVSS Score

Published: December 1, 2020 at 03:12 PM UTC

Updated: June 17, 2026 at 03:10 AM UTC

6 products affected across 1 vendorMy Cloud OS 5My Cloud PR4100My Cloud EX4100

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.8

Exploit prediction

EPSS 4%

Description

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to execute privileged commands on the device via a cookie, because of insufficient validation of URI paths.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

My Cloud OS 5 · Westerndigital

95%

v < 5.06.115

Affected range stops below 5.06.115, so it looks safe — our inference, not a vendor statement

westerndigital-my-cloud-ex2-ultra (environment) · westerndigital-my-cloud-ex4100 (environment) · westerndigital-my-cloud-mirror-gen-2 (environment) · westerndigital-my-cloud-pr2100 (environment) · westerndigital-my-cloud-pr4100 (environment)

My Cloud EX2 Ultra · Westerndigitaldevice

80%

All versions

My Cloud EX4100 · Westerndigitaldevice

80%

All versions

My Cloud Mirror Gen 2 · Westerndigitaldevice

80%

All versions

My Cloud PR2100 · Westerndigitaldevice

80%

All versions